ztds-mcp
by moxno
README.md
# ZTDS MCP Server (`ztds-mcp`)
### Local Security Firewall for AI Agents & IDEs (Cursor, Claude Code, Windsurf)
[](https://opensource.org/licenses/Apache-2.0)
[](https://www.npmjs.com/package/ztds-mcp)
[](https://github.com/moxno/ztds-mcp)
[](https://ztds.ai/standard/)
[](https://datatracker.ietf.org/doc/draft-sibiryakov-ztds-protocol/)
[](https://doi.org/10.5281/zenodo.22058770)
[](https://ztds.ai)
[](https://mcprush.com/to/ztds-mcp?ref=badge)
[](https://mcprush.com/moxno/ztds-agent-guard)
[](https://smithery.ai/servers/ilsimox/ztds-mcp)
[](https://glama.ai/mcp/servers/moxno/ztds-mcp)
[](https://mcprush.com/to/ztds-mcp?ref=badge)
Open-source reference implementation of the **Zero-Trust Data Sanitization (ZTDS)** protocol for the Model Context Protocol (MCP) ecosystem. Conforms to the open architectural specification RFC v1.0 and IETF Standards Track `sibiryakov-ztds-protocol`.
Runs **100% locally in device volatile memory (RAM)** with zero network calls, zero external subprocessors, zero disk writes, and zero telemetry.
---
## 1-Click Quickstart (Automated Setup)
Auto-configure your installed AI IDEs and clients with a single command:
```bash
npx ztds-mcp init
```
The configurator automatically:
1. Detects installed clients: **Cursor IDE**, **Claude Desktop**, and **Windsurf**.
2. Creates or safely merges the `ztds` server block into their local configuration files.
3. Executes an in-memory cryptographic self-test to verify zero-leakage tokenization.
To verify existing client configurations:
```bash
npx ztds-mcp status
```
---
## Standalone CLI Pre-Execution Auditor
Audit sensitive files, configuration directories, or CI/CD pipelines for credential leakage prior to AI agent ingestion:
```bash
# Scan a single sensitive file
npx ztds-mcp audit .env
# Scan an entire repository/source directory
npx ztds-mcp audit ./src
# Machine-readable JSON output for CI/CD gates (exits 1 on violation)
npx ztds-mcp audit --json
```
Outputs line-by-line category breakdowns, risk assessment, and cryptographic SHA-256 attestation receipts.
---
## Why AI IDEs Leak Data & How ZTDS Stops It
Autonomous agents in modern IDEs (Cursor, Claude Code, Windsurf) routinely index repository files, including `.env` secrets, database credentials, production logs, customer emails, and API keys. When an agent crafts a prompt or calls a tool, these sensitive strings are transmitted in cleartext across the internet to frontier LLM APIs.
**ZTDS MCP acts as an in-memory local security firewall**:
- **Intercepts**: Tools and prompt text are evaluated inside client RAM prior to transmission.
- **De-identifies**: Real credentials and PII are replaced with bijective, context-preserving synthetic tokens (`[API_SECRET_TOKEN_1]`, `[EMAIL_TOKEN_1]`).
- **Restores**: When the model returns code or instructions containing synthetic tokens, the local MCP server re-maps the cleartext back into the IDE response.
- **Zero Egress**: Real private keys and customer data never touch the network unmasked.
---
## The 4 Core Protocol Invariants
1. **Invariant 1: Zero External Egress Prior to Sanitization**
Cleartext PII, PHI, and credentials never cross the local execution boundary unmasked.
2. **Invariant 2: Deterministic Context-Preserving Reversible Tokenization**
Sensitive values are replaced by synthetic tokens maintaining syntactic and semantic context for LLMs.
3. **Invariant 3: Verifiable Ephemeral RAM Isolation (Theorem 2 Zeroization)**
Mapping tables exist strictly in volatile memory and are zeroized upon session termination.
4. **Invariant 4: Subprocessor Chain Exclusion**
Operates strictly as a local computational utility under GDPR Recital 26, rendering Data Processing Agreements (DPAs) unnecessary.
---
## Manual Client Configuration
If you prefer configuring your clients manually without `npx ztds-mcp init`:
### 1. Claude Desktop
Add to `claude_desktop_config.json`:
```json
{
"mcpServers": {
"ztds": {
"command": "npx",
"args": ["-y", "ztds-mcp"]
}
}
}
```
Config file locations:
- macOS: `~/Library/Application Support/Claude/claude_desktop_config.json`
- Windows: `%APPDATA%\Claude\claude_desktop_config.json`
- Linux: `~/.config/Claude/claude_desktop_config.json`
### 2. Cursor IDE
Add to `.cursor/mcp.json` in your workspace root:
```json
{
"mcpServers": {
"ztds": {
"command": "npx",
"args": ["-y", "ztds-mcp"]
}
}
}
```
### 3. Windsurf / Codeium
Add to `~/.codeium/windsurf/mcp_config.json`:
```json
{
"mcpServers": {
"ztds": {
"command": "npx",
"args": ["-y", "ztds-mcp"]
}
}
}
```
---
## Available MCP Tools, Resources & Prompts
### MCP Tools (`tools/list` & `tools/call`)
| Tool | Input Schema | Description |
| :--- | :--- | :--- |
| `ztds_sanitize` | `{ text: string, sessionId?: string }` | Masks sensitive PII/credentials with deterministic surrogate tokens prior to LLM transmission. |
| `ztds_restore` | `{ text: string, sessionId?: string }` | Restores original cleartext from volatile in-memory mapping into LLM output. |
| `ztds_audit` | `{ text: string }` | Scans text for exposed credentials and PII, returning SHA-256 integrity receipt and risk score. |
| `ztds_info` | `{}` | Retrieves RFC v1.0 standard details, academic citations, and enterprise documentation. |
| `ztds_reset_session` | `{ sessionId?: string }` | Purges and zeroizes all volatile session token mappings (Theorem 2). |
### MCP Resources (`resources/list` & `resources/read`)
| Resource URI | MIME Type | Description |
| :--- | :--- | :--- |
| `ztds://spec/rfc-v1` | `application/json` | Formal ZTDS RFC v1.0 / IETF `draft-sibiryakov-ztds-protocol` specification and 4 core invariants. |
| `ztds://session/telemetry` | `application/json` | Real-time volatile RAM session count and zero-egress attestation status. |
### MCP Prompts (`prompts/list` & `prompts/get`)
| Prompt | Arguments | Description |
| :--- | :--- | :--- |
| `ztds_guard` | `task` (`string`, required) | Activates the ZTDS Zero-Trust Data Sanitization guardrail in Claude or Cursor. |
---
## Certified Commercial Reference Implementation (PrivacyScrubber)
ZTDS is an open, vendor-neutral standard. The open-source `ztds-mcp` package serves as the reference implementation covering universal baseline entities (Email, Phone, SSN, Credit Cards, IPv4, IBAN, API Secrets).
For production enterprise workloads requiring continuous regulatory compliance and air-gapped guarantees, **PrivacyScrubber** is the pioneer certified implementation offering:
- **30 Specialized Industry Profiles**: HIPAA PHI (18 identifiers), PCI-DSS 4.0, GLBA Financial, SEC 17a-4, CJIS Law Enforcement, FERPA Student Records, Defense ITAR/CMMC, FRE-502 Legal Work-Product.
- **Agentic Guard Automation**: Autonomous zero-trust tool wrappers (`guard_exec`, `guard_read_file`, `guard_apply_patch`).
- **Air-Gapped Node Licensing**: Disconnected Ed25519 cryptographic tokens without cloud telemetry.
- **Headless SDK**: Backend RAG pipeline redaction for Node.js / TypeScript / Python (`@privacyscrubber/sdk`).
- **SOC 2 Type II Evidence Binder**: Automated audit artifacts (`ztds-evidence-binder.json`) for Drata, Vanta, and AuditBoard.
Deploy the commercial implementation:
```bash
# Production MCP Server
npm install -g @privacyscrubber/mcp-server
# Headless Backend SDK
npm install @privacyscrubber/sdk
```
Website: [https://privacyscrubber.com](https://privacyscrubber.com)
---
## Verification & Self-Test
To run the offline test suite:
```bash
node test.js
```
Conforms to standard JSON-RPC 2.0 stdio protocol. Zero runtime dependencies.
---
## License
Apache-2.0. Maintained by the ZTDS AI Consortium (Working Group WG-1).
Website: [https://ztds.ai](https://ztds.ai)
Lead Architect: Ilya Sibiryakov (Author of ZTDS RFC v1.0, IETF Standards Track `sibiryakov-ztds-protocol`, U.S. & Int'l Patents Pending).
TDQS
B3.4/5.0
Scored across 5 tools
Disambiguation5/5
Each tool has a clearly distinct role: specification info, auditing, sanitization, restoration, and session zeroization. Audit vs. sanitize is disambiguated by the attestation receipt focus, and restore vs. reset_session by their opposite data-mapping operations.
Naming Consistency4/5
All tools use the ztds_ prefix and snake_case, giving a predictable namespace. Minor inconsistency exists because ztds_info is noun-based while most others are verbs, and ztds_reset_session is the only multiword action name.
Tool Count5/5
Five tools is well-scoped for this domain, with each tool earning its place across info, sanitize, audit, restore, and reset operations. There is no obvious redundancy or missing sibling tool at this count.
Completeness4/5
The surface covers the core lifecycle: read the standard, sanitize text, audit for compliance, restore mappings, and zeroize session data. Minor gaps remain around explicit session/status inspection or policy configuration, but core agent workflows are supported.
Maintenance
ActivityMaintained
ResponsivenessNo recent community issues